5 ms·

OAuth Improvements

66 points by llambda 13y ago

pbiggar 13y ago
Thank you GitHub!! We lose so many users due to the permissions we need at https://circleci.com https://circleci.com, this is going to be awesome!
- pbiggar 13y ago
  Oh, if you want to see what this looks like in practice: https://github.com/login/oauth/authorize?client_id=78a2ba87f071c28e65bb&redirect_uri=https%3A%2F%2Fcircleci.com%2Fauth%2Fgithub%3Freturn-to%3D%252F&scope=user%2Crepo https://github.com/login/oauth/authorize?client_id=78a2ba87f... (Obviously, if you accept this, you'd be giving CircleCI access to your repos).
  - pbiggar 13y ago
    Oh, you can play around with that URL and the scopes too to see how the permissions are affected. Eg change "user" to "user:email". See http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes for a list of all the scopes.
- pornel 13y ago
  Why do you need "write access" to my "private email" (I don't even understand what does it mean — can you change e-mail address I use to log in to GitHub!?)
  - pbiggar 13y ago
    GitHub's "scopes" (permissions, see http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes) are very coarse-grained. So in this case we need to occasionally (via opt-in) add an SSH key to your account, but that permission isn't covered by a fine-leveled scope, so we need the coarse level "user" scope. We discuss it in some more detail here: https://circleci.com/docs/github-permissions https://circleci.com/docs/github-permissions
elithrar 13y ago
Definitely for this. Clearer permissions are only a good thing. (good timing too, as I'm using GitHub's OAuth flow for a small project!)
edwintorok 13y ago
Would be nice if they made the permissions more fine grained. For example split the 'Public repositories and organizations': instead of granting access to all public repos, grant access to only specific repositories.
- pbiggar 13y ago
  Yes indeed. CircleCI needs read-access to the repos you need to test, and the ability to add a read-only SSH key to those repos. Unfortunately, the only way to get that is to ask for read- and write-access to all private repos, which makes nobody happy (see http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes for the actual options).

66 points by llambda 13y ago

Thank you GitHub!! We lose so many users due to the permissions we need at https://circleci.com https://circleci.com, this is going to be awesome!

pbiggar 13y ago
Oh, if you want to see what this looks like in practice: https://github.com/login/oauth/authorize?client_id=78a2ba87f071c28e65bb&redirect_uri=https%3A%2F%2Fcircleci.com%2Fauth%2Fgithub%3Freturn-to%3D%252F&scope=user%2Crepo https://github.com/login/oauth/authorize?client_id=78a2ba87f... (Obviously, if you accept this, you'd be giving CircleCI access to your repos).
- pbiggar 13y ago
  Oh, you can play around with that URL and the scopes too to see how the permissions are affected. Eg change "user" to "user:email". See http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes for a list of all the scopes.
pornel 13y ago
Why do you need "write access" to my "private email" (I don't even understand what does it mean — can you change e-mail address I use to log in to GitHub!?)
- pbiggar 13y ago
  GitHub's "scopes" (permissions, see http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes) are very coarse-grained. So in this case we need to occasionally (via opt-in) add an SSH key to your account, but that permission isn't covered by a fine-leveled scope, so we need the coarse level "user" scope. We discuss it in some more detail here: https://circleci.com/docs/github-permissions https://circleci.com/docs/github-permissions

elithrar 13y ago

Definitely for this. Clearer permissions are only a good thing. (good timing too, as I'm using GitHub's OAuth flow for a small project!)

edwintorok 13y ago

Would be nice if they made the permissions more fine grained. For example split the 'Public repositories and organizations': instead of granting access to all public repos, grant access to only specific repositories.

pbiggar 13y ago
Yes indeed. CircleCI needs read-access to the repos you need to test, and the ability to add a read-only SSH key to those repos. Unfortunately, the only way to get that is to ask for read- and write-access to all private repos, which makes nobody happy (see http://developer.github.com/v3/oauth/#scopes http://developer.github.com/v3/oauth/#scopes for the actual options).